hxxps://store[.]steampowered[.]com/app/582660?cc=eu

Analysis

max time kernel
1800s
max time network
1684s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2024, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://store.steampowered.com/app/582660?cc=eu

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand STEAM.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
2208	msedge.exe
2208	msedge.exe
1496	identity_helper.exe
1496	identity_helper.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2452	2208	msedge.exe	83
PID 2208 wrote to memory of 2452	2208	msedge.exe	83
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 2316	2208	msedge.exe	84
PID 2208 wrote to memory of 1936	2208	msedge.exe	85
PID 2208 wrote to memory of 1936	2208	msedge.exe	85
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86
PID 2208 wrote to memory of 4496	2208	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://store.steampowered.com/app/582660?cc=eu
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ee3846f8,0x7ff8ee384708,0x7ff8ee384718
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,9128013125132040478,2103060156619701615,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,9128013125132040478,2103060156619701615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,9128013125132040478,2103060156619701615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9128013125132040478,2103060156619701615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9128013125132040478,2103060156619701615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,9128013125132040478,2103060156619701615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,9128013125132040478,2103060156619701615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9128013125132040478,2103060156619701615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9128013125132040478,2103060156619701615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9128013125132040478,2103060156619701615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,9128013125132040478,2103060156619701615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,9128013125132040478,2103060156619701615,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
73758102fd1aaddde50e0a913db1badb

SHA1
b3cb89721063667337d894ac911867bbadb62245

SHA256
efd2c0d060d4797cd329b08eee7ed3cd17aa8920664e5b3b5e872c81257766ef

SHA512
ba6cae6d968f5f4bc3cc3269a5494e16bc475608539452ed349a0aa2a95a313dc9451bd6a236798455f70785875f16cf7f20e2eaaac09fb690b567274b080312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
274B

MD5
ed67f39d3cd7990f61bfec80ea2903eb

SHA1
351f55c1354aaf18bad99292f2bf803919e54270

SHA256
9904fb2b8e0dd07bf02fadd2763a9dfcdc36a6de5d51773d8ff52b1156cb77b3

SHA512
2d3093d3e2bc8825501b4c38ee597686221eb75fd4dc1ea5f99ae1823b2ab603f99ad89f5c37cfbcdda52b1303b030fce446b663439c28114528287284c1a7a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
988ab0c2b3b0ed045af01dd88c323774

SHA1
7d41276b9d6088e327498f87f83da26f17360efc

SHA256
59e7d01fd7050c816df292285ad247d8549d6b0c914379266b76665502d733bf

SHA512
34e734b55f822d043b7907fbddb5d61567a12117fec769d1c8513cc4bea6027b05f01d3178e7b89b0cb46e44d1bb366e0ce99aa93b38985c3152e215edb5b4cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
841e810094b3b11ee907f9ad7a15c9c3

SHA1
3e96db7847b6a19068693ae139c148931ee2e6ac

SHA256
844404f25cc201e9138ca92535696e272c82de4265019c369ad07b613e7cb0e3

SHA512
76b50bac892fc6204920306e15b0cc46173fa9abbe881930fb67403b8eb864c3e242f48b6dcdbf28292676028db5c1b9676d826587d419324f4c82595b58aaed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e0806022ed189f548249e9ceaea2760c

SHA1
3c33fcfe220066b55c13ee9e3fecdb8acde3b94f

SHA256
ec4c4806955199ce5299e84b844b6e6f878d3084c146972563f2812cf23141c5

SHA512
1563b657e93aecb2d5ed1b02705e16d084715f866be553976ff76825c2f323731e905730ed66e25ffb2e3da6d1ceb25f7b0ec7866cc60a198ae79c63e077a6fb

Download Submit